/*
 *      lightlog.h
 *
 *      Copyright 2009 Daniele Ricci <denn86@gmail.com>, Luca Saccagi <luksak86@gmail.com>
 *
 *      This program is free software; you can redistribute it and/or modify
 *      it under the terms of the GNU General Public License as published by
 *      the Free Software Foundation; either version 2 of the License, or
 *      (at your option) any later version.
 *
 *      This program is distributed in the hope that it will be useful,
 *      but WITHOUT ANY WARRANTY; without even the implied warranty of
 *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *      GNU General Public License for more details.
 *
 *      You should have received a copy of the GNU General Public License
 *      along with this program; if not, write to the Free Software
 *      Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
 *      MA 02110-1301, USA.
 */











#ifndef _LIGHTLOGH
#define _LIGHTLOGH
#ifdef _WIN32
#define STATIC static
#else
#define STATIC  
#endif


/* LightLog Defines */
#include <stdio.h>
#include <time.h>
#include <malloc.h>
#include <string.h>
#include <sys/stat.h>


#ifdef _WIN32
#include <winf.h>
#else
#include <sys/time.h>
#include <sys/file.h>
#endif
/* Boolean definition */
//typedef int bool;
#define true 1
#define false 0

/* priority levels */
#define ll_EMERGENCY			0
#define ll_ALERT				1
#define ll_CRITICAL				2
#define ll_ERROR				3
#define ll_WARNING				4
#define ll_NOTICE				5
#define ll_INFORMATIONAL		6
#define ll_DEBUG				7

/* WTL: what to log */
/* ll_toXXX: from XXX to top priority (EMERGENCY) */
#define ll_toALERT				1
#define ll_toCRITICAL			2
#define ll_toERROR				3
#define ll_toWARNING			4
#define ll_toNOTICE				5
#define ll_toINFORMATIONAL 		6
#define ll_toDEBUG				7

/* ll_justXXX: just XXX priority */
#define ll_justEMERGENCY		0
#define ll_justALERT			-1
#define ll_justCRITICAL			-2
#define ll_justERROR			-3
#define ll_justWARNING			-4
#define ll_justNOTICE			-5
#define ll_justINFORMATIONAL 	-6
#define ll_justDEBUG			-7

static int WTL = ll_toINFORMATIONAL;
static int MAX_TSLEN = 500;
static char priority_str[8][5] = {"EMER","ALER","CRIT","ERRO","WARN","NOTI","INFO","DEBU"};


/* LightLog API interfaces */
/* Action errors *///0.no error //1.no write: out of priority range //2.no write: can't open the file //3.no write: can't write to file
int lightlog_record_write(char *filepath, int priority, int facility, char *pattern ,char *TIMESTAMP, int TYPEID, char *HEADER, char *SUBJECT, char *ACTION1, char *OBJECT, char *ACTION2, char *TARGET);
void lightlog_priority_set(int priority);
int lightlog_priority_get(void);
int lightlog_priority_check(int priority); 
char *lightlog_timestamp(char *out, char *pattern);
char *lightlog_timestamp_hex(char *out);
void lightlog_timestamp_destroy(char *TIMESTAMP);
FILE *lightlog_file_openTS(char *filepath);
int lightlog_file_closeTS(FILE *filetoclose);
char *lightlog_rotation(char *origpath,char *buffer,char rotationtype, int maxfilesize); // 'y' -> yearly // 'm' -> monthly // 'd' -> daily // 's' -> size based





/* IDMEF: Intrusion Detection Message Exchange Format */
#define IDMEF_MAXSIZE 10000
/* IDMEF related LightLog functions */
char *lightlog_idmef_alert_create(char *analyzerid, int messageid, char *ANALYZER, char *CREATETIME, char *CLASSIFICATION, char *_children);
char *lightlog_idmef_child(char *NAME, char *pattern ,char *ATTR1VAL, char *ATTR2VAL, char *_content,int freeATTR1,int freeATTR2, int free_content);
char *lightlog_idmef_brothers(char *_children0,char *_children1,char *_children2,char *_children3);
int lightlog_idmef_write(char *filepath, int priority, int facility, char *IDMEF_MESSAGE);

/* IDMEF related PATTERN defines */
#define IDMEF_STDPAT_SOURCE_IPV4		"Source","<%s><Node><Address category=\"%s\"><address>%s</address></Address></Node><Service><port>%s</port></Service></%s>\0","ipv4-addr"
#define IDMEF_STDPAT_TARGET_IPV4		"Target","<%s><Node><Address category=\"%s\"><address>%s</address></Address></Node><Service><port>%s</port></Service></%s>\0","ipv4-addr"
#define IDMEF_STDPAT_CREATETIME			"CreateTime","<%s ntpstamp=\"%s%s\">%s</%s>\0","",lightlog_timestamp_hex(NULL),lightlog_timestamp(NULL,"%04d-%02d-%02dT%02d:%02d:%02dZ"),0,1,1
#define IDMEF_STDPAT_ANALYZER			"Analyzer","<%s analyzerid=\"%s%s\">%s</%s>\0"
#define IDMEF_STDPAT_CLASSIFICATION		"Classification","<%s text=\"%s%s\">%s</%s>\0"
#define IDMEF_STDPAT_ADDITIONALDATA		"AdditionalData","<%s type=\"%s\" meaning=\"%s\">%s</%s>\0"
#define IDMEF_STDPAT_CORRELATIONALERT	"CorrelationAlert","<%s><name>%s%s</name>%s</%s>\0",""
#define IDMEF_STDPAT_OVERFLOWALERT		"OverflowAlert","<%s><program>%s</program><size>%s</size><buffer>%s</buffer></%s>\0"
#define IDMEF_STDPAT_ASSESSMENT			"AdditionalData","<%s type=\"%s\" meaning=\"%s\">%s</%s>\0"


#endif
